IN THE CLAIMS: 

This listing of claims will replace all prior versions, and listings, of claims in the present 
application: 

1 . (Currently amended) A method including 

receiving a user request for an object maintained at a server; 

selecting a cluster device from a plurality of cluster devices to perform an operation on 
the object according to a classification of the plurality of cluster devices based on a performance 
criterion, wherein each of the plurality of cluster devices is a separate device from the server; 

upon a request from the server, performing an operation on data associated with said 
obj e ct the operation at [[a]] the cluster device, said clust e r d e vice being a separate device from 
said s erv e r, said operation including accessing said object at said server and determining a result 
of scanning processing said object at said cluster device; and 

conditionally allowing access to said object in response to said user request based on said 

result. 

2. (Previously presented) A method as in claim 1, further including conditioning said operation 
on a feature of said object, said feature including at least one of: a file name, a file type, a 
filesystem share. 

3. (Previously presented) A method as in claim 1, further including conditioning said operation 
on an intersection of 

a feature of said object, said feature including at least one of: a file name, a file type, a 
filesystem share; and 
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a type of access associated with said user request; 

wherein said operation is performed for an intersection of at least one said feature and at 
least one type of access. 

4. (Previously presented) A method as in claim 1, further including persistently recording said 
result of said operation in association with said object. 

5. (Canceled). 

6. (Original) A method as in claim 1, wherein said operation includes a plurality of processes, 
each one process being performed at a separate cluster device. 

7. (Original) A method as in claim 1, wherein said operation includes at least one of: virus 
scanning, encryption or decryption, compression or decompression. 

8. (Original) A method as in claim 1, wherein said operation includes 

setting a timeout at said server; 

resetting said timeout in response to receiving a response from said cluster device to a 
protocol message asking if said cluster device is still working on said operation; and 

determining that said operation is successful in response to receiving a response from 
said cluster device before said timeout expires. 
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9. (Previously presented) A method as in claim 1 , farther including assigning an access type to 
said cluster device, said access type allowing said cluster device to perform said operation 
notwithstanding user locks associated with said object. 

10. (Previously presented) A method as in claim 9, further including restricting said access type 
in response to at least one of: a selected set of network addresses for said cluster device, a 
selected set of domain names for said cluster device, a selected set of user names at said cluster 
device, a selected set of interfaces between said server and said cluster device. 

1 1 . (Previously presented) A method as in claim 1 , including 

at a first time, recording said result of said operation for said object; and 
at a second time, conditioning said operation on said result. 

12. (Original) A method as in claim 11, wherein said result includes at least one of: a time when 
said operation was performed, remedial measures taken in response to said operation, whether 
access was allowed in response to said operation. 

13. (Previously presented) A method as in claim 1 , further including conditioning said operation 
on a type of access associated with said user request. 

14. (Original) A method as in claim 13, wherein said operation is performed before allowing 
access to said object for requests including read access. 



15. (Original) A method as in claim 13, wherein said operation is performed after allowing 
access to said object for requests including write access. 

16-41. (Cancelled) 

42. (Currently amended) An apparatus comprising: 

a server maintaining a set of objects, the server having a network interface for receiving a 
request to access at least one of the set of objects; and 

a plurality of cluster devices, d e vic e , s e parat e from the s e rv e r, from which the server 
selects a cluster device according to a classification of the plurality of cluster devices based on a 
performance criterion to perform, upon a request from the server, an operation on data associated 
with said at least one of the set of objects, the operation including accessing said at least one of 
the set of objects and determining a result of scanning processing said at least one of the set of 
objects at the cluster device, said result being used by the server to determine whether to allow 
access to said at least one of the set of objects in response to the request , wherein each of the 
plurality of cluster devices is a separate device from the server . 

43. (Previously presented) The apparatus of claim 42, further comprising determining whether 
to perform the operation, wherein whether to perform the operation is conditioned on a feature of 
said at least one of the set of objects, said feature including at least one of: a file name, a file 
type, a filesystem share. 
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44. (Previously presented) The apparatus of claim 42, further comprising determining whether 
to perform the operation, wherein whether to perform the operation is conditioned on an 
intersection of 

a feature of said at least one of the set of objects, said feature including at least one of: a 
file name, a file type, a filesystem share; and 

a type of access associated with said request; 

wherein said operation is performed for an intersection of at least one said feature and at 
least one type of access. 

45. (Previously presented) The apparatus of claim 42, further comprising a database, wherein 
said result is persistently recorded in association with said at least one of the set of objects in the 
database. 

46. (Canceled). 

47. (Previously presented) The apparatus of claim 42, wherein the operation includes a plurality 
of processes, each process being performed at a separate cluster device. 

48. (Previously presented) The apparatus of claim 42, wherein the operation includes at least 
one of: virus scanning, encryption or decryption, compression or decompression. 

49. (Previously presented) The apparatus of claim 42, wherein the operation includes 

setting a timeout at the server; 



6 



resetting the timeout in response to receiving a response from the cluster device to a 
protocol message asking if the cluster device is still working on the operation; and 

determining that the operation is successful in response to receiving a response from the 
cluster device before the timeout expires. 

50. (Previously presented) The apparatus of claim 42, wherein the cluster device has an access 
type, the access type allowing the cluster device to perform the operation notwithstanding user 
locks associated with said at least one of the set of objects. 

5 1 . (Previously presented) The apparatus of claim 50, wherein the access type is restricted in 
response to at least one of: a selected set of network addresses for the cluster device, a selected 
set of domain names for the cluster device, a selected set of user names at the cluster device, a 
selected set of interfaces between the server and the cluster device. 

52. (Previously presented) The apparatus of claim 45, wherein a second operation on said at 
least one of the set of objects is conditioned on the result. 

53. (Previously presented) The apparatus of claim 42, wherein said result includes at least one 
of: a time when said operation was performed, remedial measures taken in response to said 
operation, whether access was allowed in response to said operation. 

54. (Previously presented) The apparatus of claim 42, wherein the operation is conditioned on a 
type of access associated with the request. 
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55. (Previously presented) The apparatus of claim 42, wherein the operation is performed before 
allowing access to said at least one of the set of objects in response to the request, the request 
being a read access request. 

56. (Previously presented) The apparatus of claim 42, wherein the operation is performed after 
allowing access to said at least one of the set of objects in response to the request, the request 
being a write access request. 

57. (Currently amended) A machine-readable medium having sequences of instructions stored 
therein which, when executed by a processor of a processing system, cause the processor to 
perform a process comprising: 

receiving a user request for an object maintained on the processing system; 

selecting a cluster device from a plurality of cluster devices to perform an operation on 
the object according to a classification of the plurality of cluster devices based on a performance 
criterion, wherein each of the plurality of cluster devices is a separate device from the processing 
system; 

requesting [[a]] the cluster device , s e parate from th e processing syst e m, to perform the 
operation an op e ration on data associat e d with th e object , the operation including accessing the 
object at the processing system and determining a result of scanning processing the object at the 
cluster device; and 

conditionally allowing access to the object in response to the user request based on the 

result. 
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58. (Previously presented) The machine-readable medium of claim 57, wherein the process 
further comprises conditioning the operation on a feature of the object, the feature including at 
least one of: a file name, a file type, a filesystem share. 

59. (Previously presented) The machine-readable medium of claim 57, wherein the process 
further comprises conditioning the operation on an intersection of 

a feature of the object, the feature including at least one of: a file name, a file type, a 
filesystem share; and 

a type of access associated with the user request; 

wherein the operation is performed for an intersection of at least one feature and at least 
one type of access. 

60. (Previously presented) The machine-readable medium of claim 57, wherein the process 
further comprises persistently recording the result of the operation in association with the object. 

61. (Canceled). 

62. (Previously presented) The machine-readable medium of claim 57, wherein the operation 
includes a plurality of processes, each one process being performed at a separate cluster device. 
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63. (Previously presented) The machine-readable medium of claim 57, wherein the operation 
includes at least one of: virus scanning, encryption or decryption, compression or 
decompression. 

64. (Previously presented) The machine-readable medium of claim 57, wherein the operation 
includes 

setting a timeout at the server; 

resetting the timeout in response to receiving a response from the cluster device to a 
protocol message asking if the cluster device is still working on the operation; and 

determining that the operation is successful in response to receiving a response from the 
cluster device before the timeout expires. 

65. (Previously presented) The machine-readable medium of claim 57, wherein the cluster 
device having an access type, the access type allowing the cluster device to perform the 
operation notwithstanding user locks associated with the object. 

66. (Previously presented) The machine-readable medium of claim 65, wherein the access type 
is restricted in response to at least one of: a selected set of network addresses for the cluster 
device, a selected set of domain names for the cluster device, a selected set of user names at the 
cluster device, a selected set of interfaces between the server and the cluster device. 

67. (Previously presented) The machine-readable medium of claim 60, wherein a second 
operation on said at least one of the set of objects is conditioned on the result. 
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68. (Previously presented) The machine-readable medium of claim 57, wherein the result 
includes at least one of: a time when the operation was performed, remedial measures taken in 
response to the operation, whether access was allowed in response to the operation. 

69. (Previously presented) The machine-readable medium of claim 57, wherein the process 
further comprising conditioning the operation on a type of access associated with the user 
request. 

70. (Previously presented) The machine-readable medium of claim 57, wherein the operation is 
performed before allowing access to the object for requests including read access. 

71 . (Previously presented) The machine-readable medium of claim 57, wherein the operation is 
performed after allowing access to the object for requests including write access. 

72. (New) The method of claim 1, wherein said processing comprises scanning. 

73. (New) The apparatus of claim 42, wherein said processing comprises scanning. 

74. (New) The machine-readable medium of claim 57, wherein said processing comprises 
scanning. 
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